fix: OpenAPI spec accuracy — hide internal endpoints, mark signup/verify deprecated

- Remove @openapi annotations from /v1/billing/webhook (Stripe-internal)
- Remove @openapi annotations from /v1/billing/success (browser redirect)
- Mark /v1/signup/verify as deprecated (returns 410)
- Add 3 TDD tests in openapi-spec.test.ts
- Update 2 existing tests in app-routes.test.ts
- 530 tests passing (was 527)

dist/services/browser.js

@@ -27,11 +27,14 @@ export function getPoolStats() {
         })),
     };
 }
-async function recyclePage(page) {
+export async function recyclePage(page) {
     try {
         const client = await page.createCDPSession();
         await client.send("Network.clearBrowserCache").catch(() => { });
         await client.detach().catch(() => { });
+        // Clean up request interception (set by renderUrlPdf for SSRF protection)
+        page.removeAllListeners("request");
+        await page.setRequestInterception(false).catch(() => { });
         const cookies = await page.cookies();
         if (cookies.length > 0) {
             await page.deleteCookie(...cookies);
@@ -197,6 +200,8 @@ export async function renderPdf(html, options = {}) {
     const { page, instance } = await acquirePage();
     try {
         await page.setJavaScriptEnabled(false);
+        const startTime = Date.now();
+        let timeoutId;
         const result = await Promise.race([
             (async () => {
                 await page.setContent(html, { waitUntil: "domcontentloaded", timeout: 15_000 });
@@ -217,9 +222,13 @@ export async function renderPdf(html, options = {}) {
                 });
                 return Buffer.from(pdf);
             })(),
-            new Promise((_, reject) => setTimeout(() => reject(new Error("PDF_TIMEOUT")), 30_000)),
-        ]);
-        return result;
+            new Promise((_, reject) => {
+                timeoutId = setTimeout(() => reject(new Error("PDF_TIMEOUT")), 30_000);
+            }),
+        ]).finally(() => clearTimeout(timeoutId));
+        const durationMs = Date.now() - startTime;
+        logger.info(`PDF rendered in ${durationMs}ms (html, ${result.length} bytes)`);
+        return { pdf: result, durationMs };
     }
     finally {
         releasePage(page, instance);
@@ -264,6 +273,8 @@ export async function renderUrlPdf(url, options = {}) {
                 });
             }
         }
+        const startTime = Date.now();
+        let timeoutId;
         const result = await Promise.race([
             (async () => {
                 await page.goto(url, {
@@ -286,9 +297,13 @@ export async function renderUrlPdf(url, options = {}) {
                 });
                 return Buffer.from(pdf);
             })(),
-            new Promise((_, reject) => setTimeout(() => reject(new Error("PDF_TIMEOUT")), 30_000)),
-        ]);
-        return result;
+            new Promise((_, reject) => {
+                timeoutId = setTimeout(() => reject(new Error("PDF_TIMEOUT")), 30_000);
+            }),
+        ]).finally(() => clearTimeout(timeoutId));
+        const durationMs = Date.now() - startTime;
+        logger.info(`PDF rendered in ${durationMs}ms (url, ${result.length} bytes)`);
+        return { pdf: result, durationMs };
     }
     finally {
         releasePage(page, instance);